@keboola/api-client 35.0.0 → 39.0.0

package/dist/apps/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/clients/apps/appsClient.ts"],"sourcesContent":["import { readAppLogsDownload, readAppLogsTail } from '../../domain/appLogs';\nimport { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type {\n  App,\n  AppId,\n  CreateAppBody,\n  CreateCredentialBody,\n  CreateDeploymentBody,\n  CredentialId,\n  DeploymentId,\n  GetAppRunsQuery,\n  GetAppsQuery,\n  GetLogsTailQuery,\n  RunId,\n} from './types';\n\n/**\n * No `idempotencyKey`. The service accepted an `Idempotency-Key` that turned a replayed create\n * into a no-op, and support for it was **dropped on 17 Aug 2026** — the spec still documents the\n * header and has yet to catch up. It was\n * unusable from a browser in any case — the service's `Access-Control-Allow-Headers` never listed\n * the header, so sending it failed the preflight and the request never left the page.\n *\n * Every create here is therefore a genuine create, and a caller that retries one is responsible\n * for the duplicate it may produce.\n */\ntype WriteOptions = {\n  signal?: AbortSignal;\n};\n\ntype LogsTailOptions = {\n  query?: GetLogsTailQuery;\n  signal?: AbortSignal;\n};\n\n/**\n * `/v2` App Deployments — data apps plus the immutable deployment history behind them. Sibling of\n * the `dataScience` client, which wraps the same service's `/v1` surface.\n *\n * `baseUrl` must already point past the `/v2` prefix (`https://<data-science-host>/v2`); the\n * registry composes it — see `createServiceClients`.\n *\n * Two documented endpoints are deliberately absent: `PATCH /apps/{appId}` has no patchable field\n * yet (`name`/`description` are create-only, so `{}` is the only accepted body), and\n * `POST /apps/{appId}/activity` is apps-proxy's heartbeat, authenticated by a Manage API token with\n * the `apps:proxy` scope that this storage-token client cannot supply.\n */\nexport const createAppsClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const writeOptions = ({ signal }: WriteOptions) => ({ signal });\n\n  /** Service metadata (`appName`, `appVersion`, `apiDocs`) — the `/v2` surface has no `/health-check`. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps', { query }, { signal });\n\n    return data;\n  };\n\n  const getApp = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Reserves the app and its Storage configuration only. Content (`parameters`) and auth\n   * (`authorization.app_proxy`) are written afterwards through the Storage API, on the config named\n   * by the response's `componentId`/`branchId`/`configId`.\n   */\n  const createApp = async (body: CreateAppBody, options: WriteOptions = {}) => {\n    const { data } = await client.post('/apps', { body }, writeOptions(options));\n\n    return data;\n  };\n\n  const deleteApp = async (appId: AppId, signal?: AbortSignal) => {\n    await client.delete('/apps/{appId}', { path: { appId } }, { signal });\n  };\n\n  /**\n   * Drops production routing — the app's URL 404s afterwards. `null` when there was nothing to\n   * unpublish (already unpublished, or never deployed via `/v2`): the service answers `204`.\n   */\n  const unpublishApp = async (appId: AppId, signal?: AbortSignal): Promise<App | null> => {\n    const { data } = await client.post('/apps/{appId}/unpublish', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Sleeps the app now instead of waiting for the idle timer, and disarms wake-on-request: a\n   * visitor gets a `503` until an explicit {@link resumeApp}. `null` when already suspended (`204`).\n   */\n  const suspendApp = async (appId: AppId, signal?: AbortSignal): Promise<App | null> => {\n    const { data } = await client.post('/apps/{appId}/suspend', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Wakes the app now and re-arms wake-on-request. `null` when it was already running (`204`).\n   * The returned app reports `STARTING` — the operator has not confirmed it serving yet.\n   */\n  const resumeApp = async (appId: AppId, signal?: AbortSignal): Promise<App | null> => {\n    const { data } = await client.post('/apps/{appId}/resume', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** `password` is `null` until one is minted — by the app's first deployment or {@link resetAppPassword}. */\n  const getAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/password', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Mints a fresh password, replacing any existing one. Read it back with {@link getAppPassword}. */\n  const resetAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/apps/{appId}/reset-password',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Runs of the app, newest first — app-wide, so this is where a failed deployment's cause lives\n   * (`failureReason`, `startupLogs`). Narrow to one deployment with `query.deploymentId`.\n   */\n  const getAppRuns = async (appId: AppId, query: GetAppRunsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/runs', { path: { appId }, query }, { signal });\n\n    return data;\n  };\n\n  const getAppRun = async (appId: AppId, runId: RunId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/runs/{runId}',\n      { path: { appId, runId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Deploys the app's current config version as a new immutable deployment, promoting it unless\n   * `body.promote` is `false` (a staged release never runs until promoted). The id and `number` come\n   * back synchronously; readiness does not.\n   */\n  const createDeployment = async (\n    appId: AppId,\n    body?: CreateDeploymentBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  /** Full history, retired (`archived: true`) deployments included — rows outlive their workloads. */\n  const getDeployments = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/deployments', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  const getDeployment = async (appId: AppId, deploymentId: DeploymentId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Retires the deployment: the workload and its rendered-config secret go, the row stays in\n   * history as `archived`. Rejected with a `409` while the app's `production` still names it.\n   */\n  const deleteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n  };\n\n  /**\n   * Makes this deployment production — the same call rolls back, applied to an older one. The route\n   * switches only once the target serves, so the returned app's `production.desiredId` and\n   * `.actualId` differ until it converges. `null` when it was already production (`204`).\n   */\n  const promoteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ): Promise<App | null> => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments/{deploymentId}/promote',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Container output of the app's currently serving member. `query.since` and `query.lines` are\n   * mutually exclusive; passing neither returns the log from its start.\n   */\n  const getAppLogsTail = (appId: AppId, { query, signal }: LogsTailOptions = {}) =>\n    readAppLogsTail(() =>\n      client.get('/apps/{appId}/logs/tail', { path: { appId }, query }, { signal }),\n    );\n\n  const getAppLogsDownload = (appId: AppId, signal?: AbortSignal) =>\n    readAppLogsDownload(() =>\n      client.get('/apps/{appId}/logs/download', { path: { appId } }, { signal }),\n    );\n\n  const getDeploymentLogsTail = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    { query, signal }: LogsTailOptions = {},\n  ) =>\n    readAppLogsTail(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/tail',\n        { path: { appId, deploymentId }, query },\n        { signal },\n      ),\n    );\n\n  const getDeploymentLogsDownload = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) =>\n    readAppLogsDownload(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/download',\n        { path: { appId, deploymentId } },\n        { signal },\n      ),\n    );\n\n  /** The app's Git repository — managed or external. `409` when it has none configured. */\n  const getAppGitRepo = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/git-repo', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Credentials of the app's managed repository, per app rather than per deployment. */\n  const getAppGitRepoCredentials = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** An `http_token` credential returns its `secret` here and nowhere else — store it now or lose it. */\n  const createAppGitRepoCredential = async (\n    appId: AppId,\n    body: CreateCredentialBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  const deleteAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n  };\n\n  return {\n    healthCheck,\n    getApps,\n    getApp,\n    createApp,\n    deleteApp,\n    unpublishApp,\n    suspendApp,\n    resumeApp,\n    getAppPassword,\n    resetAppPassword,\n    getAppRuns,\n    getAppRun,\n    createDeployment,\n    getDeployments,\n    getDeployment,\n    deleteDeployment,\n    promoteDeployment,\n    getAppLogsTail,\n    getAppLogsDownload,\n    getDeploymentLogsTail,\n    getDeploymentLogsDownload,\n    getAppGitRepo,\n    getAppGitRepoCredentials,\n    getAppGitRepoCredential,\n    createAppGitRepoCredential,\n    deleteAppGitRepoCredential,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAmDA,MAAa,oBAAoB,EAAE,SAAS,aAAa,WAA8B;CACrF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,gBAAgB,EAAE,cAA4B,EAAE,OAAO;;CAG7D,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEhE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAc,WAAyB;EAC3D,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAElF,OAAO;CACT;;;;;;CAOA,MAAM,YAAY,OAAO,MAAqB,UAAwB,CAAC,MAAM;EAC3E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,GAAG,aAAa,OAAO,CAAC;EAE3E,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,WAAyB;EAC9D,MAAM,OAAO,OAAO,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACtE;;;;;CAMA,MAAM,eAAe,OAAO,OAAc,WAA8C;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE7F,OAAO;CACT;;;;;CAMA,MAAM,aAAa,OAAO,OAAc,WAA8C;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;;;;CAMA,MAAM,YAAY,OAAO,OAAc,WAA8C;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE1F,OAAO;CACT;;CAGA,MAAM,iBAAiB,OAAO,OAAc,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAAO,OAAc,WAAyB;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,gCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,aAAa,OAAO,OAAc,QAAyB,CAAC,GAAG,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,sBAAsB;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;EAE9F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,OAAc,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,8BACA,EAAE,MAAM;GAAE;GAAO;EAAM,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,mBAAmB,OACvB,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;;CAGA,MAAM,iBAAiB,OAAO,OAAc,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,6BAA6B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE9F,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,OAAc,cAA4B,WAAyB;EAC9F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,mBAAmB,OACvB,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;;;;;CAOA,MAAM,oBAAoB,OACxB,OACA,cACA,WACwB;EACxB,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,oDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,kBAAkB,OAAc,EAAE,OAAO,WAA4B,CAAC,MAC1E,sBACE,OAAO,IAAI,2BAA2B;EAAE,MAAM,EAAE,MAAM;EAAG;CAAM,GAAG,EAAE,OAAO,CAAC,CAC9E;CAEF,MAAM,sBAAsB,OAAc,WACxC,0BACE,OAAO,IAAI,+BAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAC3E;CAEF,MAAM,yBACJ,OACA,cACA,EAAE,OAAO,WAA4B,CAAC,MAEtC,sBACE,OAAO,IACL,sDACA;EAAE,MAAM;GAAE;GAAO;EAAa;EAAG;CAAM,GACvC,EAAE,OAAO,CACX,CACF;CAEF,MAAM,6BACJ,OACA,cACA,WAEA,0BACE,OAAO,IACL,0DACA,EAAE,MAAM;EAAE;EAAO;CAAa,EAAE,GAChC,EAAE,OAAO,CACX,CACF;;CAGF,MAAM,gBAAgB,OAAO,OAAc,WAAyB;EAClE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,2BAA2B,OAAO,OAAc,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,sCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,0BAA0B,OAC9B,OACA,cACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,6BAA6B,OACjC,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,sCACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;CAEA,MAAM,6BAA6B,OACjC,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/clients/apps/appsClient.ts"],"sourcesContent":["import { readAppLogsDownload, readAppLogsTail } from '../../domain/appLogs';\nimport { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type {\n  App,\n  AppId,\n  CreateAppBody,\n  CreateCredentialBody,\n  CreateDeploymentBody,\n  CredentialId,\n  DeploymentId,\n  GetAppRunsQuery,\n  GetAppsQuery,\n  GetDeploymentsQuery,\n  GetLogsTailQuery,\n  RunId,\n} from './types';\n\n/**\n * Options every write takes.\n *\n * - No `idempotencyKey`: the service accepts no `Idempotency-Key`, so every create here is a\n *   genuine create and a caller that retries one owns the duplicate it may produce.\n */\ntype WriteOptions = {\n  signal?: AbortSignal;\n};\n\ntype LogsTailOptions = {\n  query?: GetLogsTailQuery;\n  signal?: AbortSignal;\n};\n\n/**\n * `/v2` App Deployments — data apps plus the immutable deployment history behind them. Sibling of\n * the `dataScience` client, which wraps the same service's `/v1` surface.\n *\n * `baseUrl` must already point past the `/v2` prefix (`https://<data-science-host>/v2`); the\n * registry composes it — see `createServiceClients`.\n *\n * One documented endpoint is deliberately absent: `POST /apps/{appId}/activity` is apps-proxy's\n * heartbeat, authenticated by a Manage API token with the `apps:proxy` scope that this\n * storage-token client cannot supply.\n */\nexport const createAppsClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const writeOptions = ({ signal }: WriteOptions) => ({ signal });\n\n  /** Service metadata (`appName`, `appVersion`, `apiDocs`) — the `/v2` surface has no `/health-check`. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps', { query }, { signal });\n\n    return data;\n  };\n\n  const getApp = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Reserves the app and its Storage configuration only. Content (`parameters`) and auth\n   * (`authorization.app_proxy`) are written afterwards through the Storage API, on the config named\n   * by the response's `componentId`/`branchId`/`configId`.\n   */\n  const createApp = async (body: CreateAppBody, options: WriteOptions = {}) => {\n    const { data } = await client.post('/apps', { body }, writeOptions(options));\n\n    return data;\n  };\n\n  const deleteApp = async (appId: AppId, signal?: AbortSignal) => {\n    await client.delete('/apps/{appId}', { path: { appId } }, { signal });\n  };\n\n  /**\n   * Drops production routing — the app's URL 404s afterwards. A no-op (already unpublished, or\n   * never deployed) returns the app unchanged rather than failing.\n   */\n  const unpublishApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/unpublish', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Sleeps the app now instead of waiting for the idle timer, and disarms wake-on-request: a\n   * visitor gets a `503` until an explicit {@link resumeApp}. A no-op on an already suspended app.\n   */\n  const suspendApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/suspend', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Wakes the app now and re-arms wake-on-request. A no-op on an already running app.\n   * The returned app reports `starting` — the operator has not confirmed it serving yet.\n   */\n  const resumeApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/resume', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** `password` is `null` until one is minted — by the app's first deployment or {@link resetAppPassword}. */\n  const getAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/password', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Mints a fresh password, replacing any existing one. Read it back with {@link getAppPassword}. */\n  const resetAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/apps/{appId}/password/reset',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Runs of the app, newest first — app-wide, so this is where a failed deployment's cause lives\n   * (`failureReason`, `startupLogs`). Narrow to one deployment with `query.deploymentId`.\n   */\n  const getAppRuns = async (appId: AppId, query: GetAppRunsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/runs', { path: { appId }, query }, { signal });\n\n    return data;\n  };\n\n  const getAppRun = async (appId: AppId, runId: RunId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/runs/{runId}',\n      { path: { appId, runId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Deploys the app's current config version as a new immutable deployment, promoting it unless\n   * `body.promote` is `false` (a staged release never runs until promoted). Pin an older config\n   * version with `body.configVersion`. The deployment comes back synchronously; readiness does not.\n   */\n  const createDeployment = async (\n    appId: AppId,\n    body?: CreateDeploymentBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  /**\n   * Deployment history, newest page first.\n   *\n   * - `query.archived` filters on whether the deployment was deleted; omitting it returns both.\n   * - A deleted deployment keeps its row — history outlives the workload.\n   */\n  const getDeployments = async (\n    appId: AppId,\n    query: GetDeploymentsQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments',\n      { path: { appId }, query },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getDeployment = async (appId: AppId, deploymentId: DeploymentId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Deletes the deployment: its running resources and credentials go, the row stays in history as\n   * `archived`. Rejected with a `409` while the app's `production` still names it.\n   */\n  const deleteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n  };\n\n  /**\n   * Makes this deployment production — the same call rolls back, applied to an older one. The route\n   * switches only once the target serves, so the returned app's `production.desiredDeploymentId`\n   * and `.actualDeploymentId` differ until it converges.\n   */\n  const promoteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ): Promise<App> => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments/{deploymentId}/promote',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Container output of the app's currently serving member. `query.since` and `query.lines` are\n   * mutually exclusive; passing neither returns the log from its start.\n   */\n  const getAppLogsTail = (appId: AppId, { query, signal }: LogsTailOptions = {}) =>\n    readAppLogsTail(() =>\n      client.get('/apps/{appId}/logs/tail', { path: { appId }, query }, { signal }),\n    );\n\n  const getAppLogsDownload = (appId: AppId, signal?: AbortSignal) =>\n    readAppLogsDownload(() =>\n      client.get('/apps/{appId}/logs/download', { path: { appId } }, { signal }),\n    );\n\n  const getDeploymentLogsTail = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    { query, signal }: LogsTailOptions = {},\n  ) =>\n    readAppLogsTail(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/tail',\n        { path: { appId, deploymentId }, query },\n        { signal },\n      ),\n    );\n\n  const getDeploymentLogsDownload = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) =>\n    readAppLogsDownload(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/download',\n        { path: { appId, deploymentId } },\n        { signal },\n      ),\n    );\n\n  /** The app's Git repository — managed or external. `409` when it has none configured. */\n  const getAppGitRepo = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/git-repo', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Credentials of the app's managed repository, per app rather than per deployment. */\n  const getAppGitRepoCredentials = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** An `http_token` credential returns its `secret` here and nowhere else — store it now or lose it. */\n  const createAppGitRepoCredential = async (\n    appId: AppId,\n    body: CreateCredentialBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  const deleteAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n  };\n\n  return {\n    healthCheck,\n    getApps,\n    getApp,\n    createApp,\n    deleteApp,\n    unpublishApp,\n    suspendApp,\n    resumeApp,\n    getAppPassword,\n    resetAppPassword,\n    getAppRuns,\n    getAppRun,\n    createDeployment,\n    getDeployments,\n    getDeployment,\n    deleteDeployment,\n    promoteDeployment,\n    getAppLogsTail,\n    getAppLogsDownload,\n    getDeploymentLogsTail,\n    getDeploymentLogsDownload,\n    getAppGitRepo,\n    getAppGitRepoCredentials,\n    getAppGitRepoCredential,\n    createAppGitRepoCredential,\n    deleteAppGitRepoCredential,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;AA+CA,MAAa,oBAAoB,EAAE,SAAS,aAAa,WAA8B;CACrF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,gBAAgB,EAAE,cAA4B,EAAE,OAAO;;CAG7D,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEhE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAc,WAAyB;EAC3D,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAElF,OAAO;CACT;;;;;;CAOA,MAAM,YAAY,OAAO,MAAqB,UAAwB,CAAC,MAAM;EAC3E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,GAAG,aAAa,OAAO,CAAC;EAE3E,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,WAAyB;EAC9D,MAAM,OAAO,OAAO,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACtE;;;;;CAMA,MAAM,eAAe,OAAO,OAAc,WAAuC;EAC/E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE7F,OAAO;CACT;;;;;CAMA,MAAM,aAAa,OAAO,OAAc,WAAuC;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;;;;CAMA,MAAM,YAAY,OAAO,OAAc,WAAuC;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE1F,OAAO;CACT;;CAGA,MAAM,iBAAiB,OAAO,OAAc,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAAO,OAAc,WAAyB;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,gCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,aAAa,OAAO,OAAc,QAAyB,CAAC,GAAG,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,sBAAsB;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;EAE9F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,OAAc,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,8BACA,EAAE,MAAM;GAAE;GAAO;EAAM,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,mBAAmB,OACvB,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;;;;;;;CAQA,MAAM,iBAAiB,OACrB,OACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,OAAc,cAA4B,WAAyB;EAC9F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,mBAAmB,OACvB,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;;;;;CAOA,MAAM,oBAAoB,OACxB,OACA,cACA,WACiB;EACjB,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,oDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,kBAAkB,OAAc,EAAE,OAAO,WAA4B,CAAC,MAC1E,sBACE,OAAO,IAAI,2BAA2B;EAAE,MAAM,EAAE,MAAM;EAAG;CAAM,GAAG,EAAE,OAAO,CAAC,CAC9E;CAEF,MAAM,sBAAsB,OAAc,WACxC,0BACE,OAAO,IAAI,+BAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAC3E;CAEF,MAAM,yBACJ,OACA,cACA,EAAE,OAAO,WAA4B,CAAC,MAEtC,sBACE,OAAO,IACL,sDACA;EAAE,MAAM;GAAE;GAAO;EAAa;EAAG;CAAM,GACvC,EAAE,OAAO,CACX,CACF;CAEF,MAAM,6BACJ,OACA,cACA,WAEA,0BACE,OAAO,IACL,0DACA,EAAE,MAAM;EAAE;EAAO;CAAa,EAAE,GAChC,EAAE,OAAO,CACX,CACF;;CAGF,MAAM,gBAAgB,OAAO,OAAc,WAAyB;EAClE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,2BAA2B,OAAO,OAAc,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,sCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,0BAA0B,OAC9B,OACA,cACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,6BAA6B,OACjC,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,sCACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;CAEA,MAAM,6BAA6B,OACjC,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/apps/types.d.cts

@@ -1,3 +1,3 @@
-import { _ as DeploymentRunState, a as AppRun, b as GetLogsTailQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as RunId, y as GetAppsQuery } from "../types-DARv_P6O.cjs";
+import { S as RunId, _ as DeploymentRunState, a as AppRun, b as GetDeploymentsQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as GetLogsTailQuery, y as GetAppsQuery } from "../types-DXskkNp8.cjs";
 import { t as LogEntry } from "../appLogs-D5A13Y0y.cjs";
-export { App, AppGitRepo, AppId, AppPassword, AppRun, AppState, CreateAppBody, CreateCredentialBody, CreateDeploymentBody, CreatedCredential, Credential, CredentialId, CredentialList, Deployment, DeploymentBuildState, DeploymentId, DeploymentRunState, GetAppRunsQuery, GetAppsQuery, GetLogsTailQuery, type LogEntry, RunId };
+export { App, AppGitRepo, AppId, AppPassword, AppRun, AppState, CreateAppBody, CreateCredentialBody, CreateDeploymentBody, CreatedCredential, Credential, CredentialId, CredentialList, Deployment, DeploymentBuildState, DeploymentId, DeploymentRunState, GetAppRunsQuery, GetAppsQuery, GetDeploymentsQuery, GetLogsTailQuery, type LogEntry, RunId };

package/dist/apps/types.d.ts

@@ -1,3 +1,3 @@
-import { _ as DeploymentRunState, a as AppRun, b as GetLogsTailQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as RunId, y as GetAppsQuery } from "../types-CBgLCkYe.js";
+import { S as RunId, _ as DeploymentRunState, a as AppRun, b as GetDeploymentsQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as GetLogsTailQuery, y as GetAppsQuery } from "../types-D6UmMa6E.js";
 import { t as LogEntry } from "../appLogs-Ch7DYpzx.js";
-export { App, AppGitRepo, AppId, AppPassword, AppRun, AppState, CreateAppBody, CreateCredentialBody, CreateDeploymentBody, CreatedCredential, Credential, CredentialId, CredentialList, Deployment, DeploymentBuildState, DeploymentId, DeploymentRunState, GetAppRunsQuery, GetAppsQuery, GetLogsTailQuery, type LogEntry, RunId };
+export { App, AppGitRepo, AppId, AppPassword, AppRun, AppState, CreateAppBody, CreateCredentialBody, CreateDeploymentBody, CreatedCredential, Credential, CredentialId, CredentialList, Deployment, DeploymentBuildState, DeploymentId, DeploymentRunState, GetAppRunsQuery, GetAppsQuery, GetDeploymentsQuery, GetLogsTailQuery, type LogEntry, RunId };

package/dist/assets/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createGenericFetchClient = require("../createGenericFetchClient-o3cPJeRn.cjs");
+const require_createGenericFetchClient = require("../createGenericFetchClient-lcozzwk2.cjs");
 const require_assets_schema = require("./schema.cjs");
 //#region src/clients/assets/assetsClient.ts
 const createAssetsClient = ({ baseUrl, middlewares }) => {

package/dist/assets/index.js

@@ -1,4 +1,4 @@
-import { t as createGenericFetchClient } from "../createGenericFetchClient-rxvUUbap.js";
+import { t as createGenericFetchClient } from "../createGenericFetchClient-Bnf1QK9W.js";
 import { componentTemplatesSchema, publishedPostsSchema } from "./schema.js";
 //#region src/clients/assets/assetsClient.ts
 const createAssetsClient = ({ baseUrl, middlewares }) => {

package/dist/auth/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_authClient = require("../authClient-_PpvGgZJ.cjs");
+const require_authClient = require("../authClient-8yU1last.cjs");
 exports.MFA_METHOD = require_authClient.MFA_METHOD;
 exports.changeInputSchema = require_authClient.changeInputSchema;
 exports.createAuthClient = require_authClient.createAuthClient;

package/dist/auth/index.js

@@ -1,2 +1,2 @@
-import { a as MFA_METHOD, c as totpVerifyInputSchema, d as loginSuccessSchema, f as mfaChallengeSchema, i as resetRequestInputSchema, l as loginInputSchema, n as changeInputSchema, o as mfaCodeInputSchema, p as oidcInputSchema, r as resetInputSchema, s as mfaWebauthnInputSchema, t as createAuthClient, u as loginResultSchema } from "../authClient-D7W9vWPR.js";
+import { a as MFA_METHOD, c as totpVerifyInputSchema, d as loginSuccessSchema, f as mfaChallengeSchema, i as resetRequestInputSchema, l as loginInputSchema, n as changeInputSchema, o as mfaCodeInputSchema, p as oidcInputSchema, r as resetInputSchema, s as mfaWebauthnInputSchema, t as createAuthClient, u as loginResultSchema } from "../authClient-BTo4Afm6.js";
 export { MFA_METHOD, changeInputSchema, createAuthClient, loginInputSchema, loginResultSchema, loginSuccessSchema, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };

package/dist/{auth-aItmDu45.js → auth-BjmkFOgd.js}

@@ -1,4 +1,4 @@
-import { h as KeboolaHttpHeader, s as HttpHeader } from "./createFetchClient-U-ZrwPl2.js";
+import { h as KeboolaHttpHeader, s as HttpHeader } from "./createFetchClient-C-cadpBx.js";
 //#region src/clients/auth.ts
 const createAuthHeaders = (auth) => {
 	if (auth.type === "sapi-token") return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };
@@ -10,4 +10,4 @@ const createAuthHeaders = (auth) => {
 //#endregion
 export { createAuthHeaders as t };
 
-//# sourceMappingURL=auth-aItmDu45.js.map
+//# sourceMappingURL=auth-BjmkFOgd.js.map

package/dist/{auth-aItmDu45.js.map → auth-BjmkFOgd.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-aItmDu45.js","names":[],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAG,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJ,WAAW,gBAAgB,UAAU,KAAK;GAC1C,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}
+{"version":3,"file":"auth-BjmkFOgd.js","names":[],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAG,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJ,WAAW,gBAAgB,UAAU,KAAK;GAC1C,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}

package/dist/{auth-JQ33o3nU.cjs → auth-DLWnl18b.cjs}

@@ -1,4 +1,4 @@
-const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
+const require_createFetchClient = require("./createFetchClient-BlgPbjFj.cjs");
 //#region src/clients/auth.ts
 const createAuthHeaders = (auth) => {
 	if (auth.type === "sapi-token") return { [require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };
@@ -15,4 +15,4 @@ Object.defineProperty(exports, "createAuthHeaders", {
 	}
 });
 
-//# sourceMappingURL=auth-JQ33o3nU.cjs.map
+//# sourceMappingURL=auth-DLWnl18b.cjs.map

package/dist/{auth-JQ33o3nU.cjs.map → auth-DLWnl18b.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-JQ33o3nU.cjs","names":["KeboolaHttpHeader","HttpHeader"],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAGA,0BAAAA,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJC,0BAAAA,WAAW,gBAAgB,UAAU,KAAK;GAC1CD,0BAAAA,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}
+{"version":3,"file":"auth-DLWnl18b.cjs","names":["KeboolaHttpHeader","HttpHeader"],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAGA,0BAAAA,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJC,0BAAAA,WAAW,gBAAgB,UAAU,KAAK;GAC1CD,0BAAAA,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}

package/dist/{authClient-_PpvGgZJ.cjs → authClient-8yU1last.cjs}

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
-const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-CsvYmCOI.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-o3cPJeRn.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DhUU3M1W.cjs");
+const require_createFetchClient = require("./createFetchClient-BlgPbjFj.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-CvBKyeDO.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-lcozzwk2.cjs");
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-C3UmDXpe.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
 //#region src/clients/auth/device/device.ts
@@ -507,4 +507,4 @@ Object.defineProperty(exports, "totpVerifyInputSchema", {
 	}
 });
 
-//# sourceMappingURL=authClient-_PpvGgZJ.cjs.map
+//# sourceMappingURL=authClient-8yU1last.cjs.map

package/dist/{authClient-_PpvGgZJ.cjs.map → authClient-8yU1last.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"authClient-_PpvGgZJ.cjs","names":["z","z","z","HttpHeader","createOpenapiFetchClient","validateConnectionStatus","createGenericFetchClient"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  CreatePatBodyRaw,\n  CreatePatInput,\n  ExchangePatBodyRaw,\n  ExchangePatInput,\n  PatScopeInput,\n  RevokePatPath,\n} from './types';\n\n/**\n * Drop the keys whose value is `null` or `undefined`, and only those — an empty array or string is\n * a value the caller meant.\n *\n * The spec documents each optional PAT field as \"Omit (do not send `null`)\". Callers hold nullables\n * either way — an empty expiry picker, an untouched switch — so the rule lives here rather than at\n * every call site, where one of them would forget it.\n */\nconst withoutNullish = (entries: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(entries).filter(([, value]) => value != null));\n\n/** `undefined` for a scope that narrows nothing — which is what an absent `scope` already asks for. */\nconst toScope = (scope: PatScopeInput | null | undefined): Record<string, unknown> | undefined => {\n  if (scope == null) return undefined;\n\n  const payload = withoutNullish({ projects: scope.projects, readOnly: scope.readOnly });\n  return Object.keys(payload).length > 0 ? payload : undefined;\n};\n\n// `as unknown as` at these two boundaries: `CreatePatBodyRaw` and `ExchangePatBodyRaw` both demand\n// the keys the endpoint documents as omittable, so the honest body is not expressible in either.\nconst toCreateBody = ({ name, expiresIn, scope }: CreatePatInput): CreatePatBodyRaw =>\n  ({\n    name,\n    ...withoutNullish({ expiresIn, scope: toScope(scope) }),\n  }) as unknown as CreatePatBodyRaw;\n\nconst toExchangeBody = ({ expiresIn, scope }: ExchangePatInput): ExchangePatBodyRaw =>\n  withoutNullish({ expiresIn, scope: toScope(scope) }) as unknown as ExchangePatBodyRaw;\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (input: CreatePatInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body: toCreateBody(input) }, { signal });\n    return data;\n  };\n\n  /**\n   * Issue a child token from the one this request is authorized with.\n   *\n   * A child only ever attenuates its parent, so an empty input is a full-inheritance copy.\n   */\n  const exchange = async (input: ExchangePatInput = {}, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/pat/exchange',\n      { body: toExchangeBody(input) },\n      { signal },\n    );\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;;;;;;;;;ACZA,MAAM,kBAAkB,YACtB,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,SAAS,IAAI,CAAC;;AAGjF,MAAM,WAAW,UAAiF;CAChG,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,MAAM,UAAU,eAAe;EAAE,UAAU,MAAM;EAAU,UAAU,MAAM;CAAS,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,UAAU,KAAA;AACrD;AAIA,MAAM,gBAAgB,EAAE,MAAM,WAAW,aACtC;CACC;CACA,GAAG,eAAe;EAAE;EAAW,OAAO,QAAQ,KAAK;CAAE,CAAC;AACxD;AAEF,MAAM,kBAAkB,EAAE,WAAW,YACnC,eAAe;CAAE;CAAW,OAAO,QAAQ,KAAK;AAAE,CAAC;AAErD,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAuB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;EAC5F,OAAO;CACT;;;;;;CAOA,MAAM,WAAW,OAAO,QAA0B,CAAC,GAAG,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,yBACA,EAAE,MAAM,eAAe,KAAK,EAAE,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACnEA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAGC,0BAAAA,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,gBAAgBC,iCAAAA;CAClB,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAC7C;EACA;EACA,gBAAgBD,iCAAAA;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}
+{"version":3,"file":"authClient-8yU1last.cjs","names":["z","z","z","HttpHeader","createOpenapiFetchClient","validateConnectionStatus","createGenericFetchClient"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  CreatePatBodyRaw,\n  CreatePatInput,\n  ExchangePatBodyRaw,\n  ExchangePatInput,\n  PatScopeInput,\n  RevokePatPath,\n} from './types';\n\n/**\n * Drop the keys whose value is `null` or `undefined`, and only those — an empty array or string is\n * a value the caller meant.\n *\n * The spec documents each optional PAT field as \"Omit (do not send `null`)\". Callers hold nullables\n * either way — an empty expiry picker, an untouched switch — so the rule lives here rather than at\n * every call site, where one of them would forget it.\n */\nconst withoutNullish = (entries: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(entries).filter(([, value]) => value != null));\n\n/** `undefined` for a scope that narrows nothing — which is what an absent `scope` already asks for. */\nconst toScope = (scope: PatScopeInput | null | undefined): Record<string, unknown> | undefined => {\n  if (scope == null) return undefined;\n\n  const payload = withoutNullish({ projects: scope.projects, readOnly: scope.readOnly });\n  return Object.keys(payload).length > 0 ? payload : undefined;\n};\n\n// `as unknown as` at these two boundaries: `CreatePatBodyRaw` and `ExchangePatBodyRaw` both demand\n// the keys the endpoint documents as omittable, so the honest body is not expressible in either.\nconst toCreateBody = ({ name, expiresIn, scope }: CreatePatInput): CreatePatBodyRaw =>\n  ({\n    name,\n    ...withoutNullish({ expiresIn, scope: toScope(scope) }),\n  }) as unknown as CreatePatBodyRaw;\n\nconst toExchangeBody = ({ expiresIn, scope }: ExchangePatInput): ExchangePatBodyRaw =>\n  withoutNullish({ expiresIn, scope: toScope(scope) }) as unknown as ExchangePatBodyRaw;\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (input: CreatePatInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body: toCreateBody(input) }, { signal });\n    return data;\n  };\n\n  /**\n   * Issue a child token from the one this request is authorized with.\n   *\n   * A child only ever attenuates its parent, so an empty input is a full-inheritance copy.\n   */\n  const exchange = async (input: ExchangePatInput = {}, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/pat/exchange',\n      { body: toExchangeBody(input) },\n      { signal },\n    );\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;;;;;;;;;ACZA,MAAM,kBAAkB,YACtB,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,SAAS,IAAI,CAAC;;AAGjF,MAAM,WAAW,UAAiF;CAChG,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,MAAM,UAAU,eAAe;EAAE,UAAU,MAAM;EAAU,UAAU,MAAM;CAAS,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,UAAU,KAAA;AACrD;AAIA,MAAM,gBAAgB,EAAE,MAAM,WAAW,aACtC;CACC;CACA,GAAG,eAAe;EAAE;EAAW,OAAO,QAAQ,KAAK;CAAE,CAAC;AACxD;AAEF,MAAM,kBAAkB,EAAE,WAAW,YACnC,eAAe;CAAE;CAAW,OAAO,QAAQ,KAAK;AAAE,CAAC;AAErD,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAuB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;EAC5F,OAAO;CACT;;;;;;CAOA,MAAM,WAAW,OAAO,QAA0B,CAAC,GAAG,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,yBACA,EAAE,MAAM,eAAe,KAAK,EAAE,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACnEA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAGC,0BAAAA,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,gBAAgBC,iCAAAA;CAClB,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAC7C;EACA;EACA,gBAAgBD,iCAAAA;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}

package/dist/{authClient-D7W9vWPR.js → authClient-BTo4Afm6.js}

@@ -1,7 +1,7 @@
-import { s as HttpHeader } from "./createFetchClient-U-ZrwPl2.js";
-import { t as validateConnectionStatus } from "./validateConnectionStatus-olE2sQ3U.js";
-import { t as createGenericFetchClient } from "./createGenericFetchClient-rxvUUbap.js";
-import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-BVSc9ibR.js";
+import { s as HttpHeader } from "./createFetchClient-C-cadpBx.js";
+import { t as validateConnectionStatus } from "./validateConnectionStatus-828HV8WL.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-Bnf1QK9W.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-COaPeeQ0.js";
 import * as z$1 from "zod";
 //#region src/clients/auth/device/device.ts
 const createDevice = (client) => {
@@ -428,4 +428,4 @@ const createAuthClient = ({ baseUrl, middlewares }) => {
 //#endregion
 export { MFA_METHOD as a, totpVerifyInputSchema as c, loginSuccessSchema as d, mfaChallengeSchema as f, resetRequestInputSchema as i, loginInputSchema as l, changeInputSchema as n, mfaCodeInputSchema as o, oidcInputSchema as p, resetInputSchema as r, mfaWebauthnInputSchema as s, createAuthClient as t, loginResultSchema as u };
 
-//# sourceMappingURL=authClient-D7W9vWPR.js.map
+//# sourceMappingURL=authClient-BTo4Afm6.js.map

package/dist/{authClient-D7W9vWPR.js.map → authClient-BTo4Afm6.js.map}

@@ -1 +1 @@
-{"version":3,"file":"authClient-D7W9vWPR.js","names":["z","z","z"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  CreatePatBodyRaw,\n  CreatePatInput,\n  ExchangePatBodyRaw,\n  ExchangePatInput,\n  PatScopeInput,\n  RevokePatPath,\n} from './types';\n\n/**\n * Drop the keys whose value is `null` or `undefined`, and only those — an empty array or string is\n * a value the caller meant.\n *\n * The spec documents each optional PAT field as \"Omit (do not send `null`)\". Callers hold nullables\n * either way — an empty expiry picker, an untouched switch — so the rule lives here rather than at\n * every call site, where one of them would forget it.\n */\nconst withoutNullish = (entries: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(entries).filter(([, value]) => value != null));\n\n/** `undefined` for a scope that narrows nothing — which is what an absent `scope` already asks for. */\nconst toScope = (scope: PatScopeInput | null | undefined): Record<string, unknown> | undefined => {\n  if (scope == null) return undefined;\n\n  const payload = withoutNullish({ projects: scope.projects, readOnly: scope.readOnly });\n  return Object.keys(payload).length > 0 ? payload : undefined;\n};\n\n// `as unknown as` at these two boundaries: `CreatePatBodyRaw` and `ExchangePatBodyRaw` both demand\n// the keys the endpoint documents as omittable, so the honest body is not expressible in either.\nconst toCreateBody = ({ name, expiresIn, scope }: CreatePatInput): CreatePatBodyRaw =>\n  ({\n    name,\n    ...withoutNullish({ expiresIn, scope: toScope(scope) }),\n  }) as unknown as CreatePatBodyRaw;\n\nconst toExchangeBody = ({ expiresIn, scope }: ExchangePatInput): ExchangePatBodyRaw =>\n  withoutNullish({ expiresIn, scope: toScope(scope) }) as unknown as ExchangePatBodyRaw;\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (input: CreatePatInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body: toCreateBody(input) }, { signal });\n    return data;\n  };\n\n  /**\n   * Issue a child token from the one this request is authorized with.\n   *\n   * A child only ever attenuates its parent, so an empty input is a full-inheritance copy.\n   */\n  const exchange = async (input: ExchangePatInput = {}, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/pat/exchange',\n      { body: toExchangeBody(input) },\n      { signal },\n    );\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;;;;;;;;;ACZA,MAAM,kBAAkB,YACtB,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,SAAS,IAAI,CAAC;;AAGjF,MAAM,WAAW,UAAiF;CAChG,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,MAAM,UAAU,eAAe;EAAE,UAAU,MAAM;EAAU,UAAU,MAAM;CAAS,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,UAAU,KAAA;AACrD;AAIA,MAAM,gBAAgB,EAAE,MAAM,WAAW,aACtC;CACC;CACA,GAAG,eAAe;EAAE;EAAW,OAAO,QAAQ,KAAK;CAAE,CAAC;AACxD;AAEF,MAAM,kBAAkB,EAAE,WAAW,YACnC,eAAe;CAAE;CAAW,OAAO,QAAQ,KAAK;AAAE,CAAC;AAErD,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAuB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;EAC5F,OAAO;CACT;;;;;;CAOA,MAAM,WAAW,OAAO,QAA0B,CAAC,GAAG,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,yBACA,EAAE,MAAM,eAAe,KAAK,EAAE,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACnEA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAG,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}
+{"version":3,"file":"authClient-BTo4Afm6.js","names":["z","z","z"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  CreatePatBodyRaw,\n  CreatePatInput,\n  ExchangePatBodyRaw,\n  ExchangePatInput,\n  PatScopeInput,\n  RevokePatPath,\n} from './types';\n\n/**\n * Drop the keys whose value is `null` or `undefined`, and only those — an empty array or string is\n * a value the caller meant.\n *\n * The spec documents each optional PAT field as \"Omit (do not send `null`)\". Callers hold nullables\n * either way — an empty expiry picker, an untouched switch — so the rule lives here rather than at\n * every call site, where one of them would forget it.\n */\nconst withoutNullish = (entries: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(entries).filter(([, value]) => value != null));\n\n/** `undefined` for a scope that narrows nothing — which is what an absent `scope` already asks for. */\nconst toScope = (scope: PatScopeInput | null | undefined): Record<string, unknown> | undefined => {\n  if (scope == null) return undefined;\n\n  const payload = withoutNullish({ projects: scope.projects, readOnly: scope.readOnly });\n  return Object.keys(payload).length > 0 ? payload : undefined;\n};\n\n// `as unknown as` at these two boundaries: `CreatePatBodyRaw` and `ExchangePatBodyRaw` both demand\n// the keys the endpoint documents as omittable, so the honest body is not expressible in either.\nconst toCreateBody = ({ name, expiresIn, scope }: CreatePatInput): CreatePatBodyRaw =>\n  ({\n    name,\n    ...withoutNullish({ expiresIn, scope: toScope(scope) }),\n  }) as unknown as CreatePatBodyRaw;\n\nconst toExchangeBody = ({ expiresIn, scope }: ExchangePatInput): ExchangePatBodyRaw =>\n  withoutNullish({ expiresIn, scope: toScope(scope) }) as unknown as ExchangePatBodyRaw;\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (input: CreatePatInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body: toCreateBody(input) }, { signal });\n    return data;\n  };\n\n  /**\n   * Issue a child token from the one this request is authorized with.\n   *\n   * A child only ever attenuates its parent, so an empty input is a full-inheritance copy.\n   */\n  const exchange = async (input: ExchangePatInput = {}, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/pat/exchange',\n      { body: toExchangeBody(input) },\n      { signal },\n    );\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;;;;;;;;;ACZA,MAAM,kBAAkB,YACtB,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,SAAS,IAAI,CAAC;;AAGjF,MAAM,WAAW,UAAiF;CAChG,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,MAAM,UAAU,eAAe;EAAE,UAAU,MAAM;EAAU,UAAU,MAAM;CAAS,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,UAAU,KAAA;AACrD;AAIA,MAAM,gBAAgB,EAAE,MAAM,WAAW,aACtC;CACC;CACA,GAAG,eAAe;EAAE;EAAW,OAAO,QAAQ,KAAK;CAAE,CAAC;AACxD;AAEF,MAAM,kBAAkB,EAAE,WAAW,YACnC,eAAe;CAAE;CAAW,OAAO,QAAQ,KAAK;AAAE,CAAC;AAErD,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAuB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;EAC5F,OAAO;CACT;;;;;;CAOA,MAAM,WAAW,OAAO,QAA0B,CAAC,GAAG,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,yBACA,EAAE,MAAM,eAAe,KAAK,EAAE,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACnEA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAG,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}

package/dist/billing/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DhUU3M1W.cjs");
-const require_auth = require("../auth-JQ33o3nU.cjs");
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-C3UmDXpe.cjs");
+const require_auth = require("../auth-DLWnl18b.cjs");
 //#region src/clients/billing/billingClient.ts
 const createBillingClient = ({ baseUrl, middlewares, auth }) => {
 	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({

package/dist/billing/index.js

@@ -1,5 +1,5 @@
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-BVSc9ibR.js";
-import { t as createAuthHeaders } from "../auth-aItmDu45.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-COaPeeQ0.js";
+import { t as createAuthHeaders } from "../auth-BjmkFOgd.js";
 //#region src/clients/billing/billingClient.ts
 const createBillingClient = ({ baseUrl, middlewares, auth }) => {
 	const client = createOpenapiFetchClient({

package/dist/businessWorkspaceApi/index.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_businessWorkspaceApi = require("../businessWorkspaceApi-wyBdbpIJ.cjs");
+exports.createBusinessWorkspaceApiClient = require_businessWorkspaceApi.createBusinessWorkspaceApiClient;

package/dist/businessWorkspaceApi/index.d.cts

@@ -0,0 +1,2 @@
+import { n as createBusinessWorkspaceApiClient } from "../businessWorkspaceApiClient-CRM1U8b-.cjs";
+export { createBusinessWorkspaceApiClient };

package/dist/businessWorkspaceApi/index.d.ts

@@ -0,0 +1,2 @@
+import { n as createBusinessWorkspaceApiClient } from "../businessWorkspaceApiClient-C2WyWN3b.js";
+export { createBusinessWorkspaceApiClient };

package/dist/businessWorkspaceApi/index.js

@@ -0,0 +1,2 @@
+import { t as createBusinessWorkspaceApiClient } from "../businessWorkspaceApi-BD-iUj07.js";
+export { createBusinessWorkspaceApiClient };

package/dist/businessWorkspaceApi/types.d.cts

@@ -0,0 +1,2 @@
+import { a as DashboardId, i as BusinessWorkspaceDashboardSummary, o as DashboardInput, r as BusinessWorkspaceDashboard, t as BusinessWorkspaceApiClient } from "../businessWorkspaceApiClient-CRM1U8b-.cjs";
+export { type BusinessWorkspaceApiClient, BusinessWorkspaceDashboard, BusinessWorkspaceDashboardSummary, DashboardId, DashboardInput };